TRA Release History

SaaS Introduction

SaaS Business Rules

File Transfer Introduction

File Transfer Business Drivers

BR-SA-10: Applications in CMS Data Centers May Not Use Some Native Email Protocols

CMS Strategic Guidance and Preferred Solutions

Introduction to Data Management

Enterprise Data Mesh

File Transfer

Guiding Principles

CMS Strategic Guidance & Preferred Solutions

Introduction to Data Management

Enterprise Data Sharing & Governance

New content describes major CMS data services and data sources.

New guidance emphasizes how CMS data must be kept within CMS authorization boundaries.

Application Development

Infrastructure Services

Blockchain Technology

Fast Data

Updated Business Rule to reflect new CMS email architecture based on move from HHS to CMS tenant.

BR-SA-1: Use CMS Shared Services

BR-SA-2: Integrate with the CMS Identity Management Services

BR-SQ-5: Manual Code and Design Reviews Are Mandatory

Legacy Volume, Chapter, and Section references changed to hyperlinks to content titles

Selected business rule references now link to the rules

CMS Services Framework

CMS Services Framework Guidance

CMS Services Framework Services

Services Framework

Services Framework - Mediation Services

Services Framework Summary

CMS Multi-Zone Architecture

Significant updates across the entire Services Framework section. Includes new content and clarification of services framework concepts and relationship to multi-zone architecture.

Also includes re-organization of the content, so some prior topics are removed and content shifted into different topics

Software as a Service Introduction

BR-SAAS-6: Perform Configuration Management

Need a historical account of all changes made to the TRA:

Added the complete change log as its own section. It will be redacted for the external versions. It will not contain "in-flight" changes.

Services Framework

Glossary

Services Framework - Framework

Glossary

Legacy footnotes embedded in text (hover) are showing obsolete or redundant information:

Removed (hover) footnote text where applicable. (ongoing)

The titles/names of over 40 controls were changed in ARS 5:

Updated all TRA references to these controls to align with the new ARS 5 naming

21 new security controls were added to CMS baselines with ARS 5:

Added TRA references to the new controls as appropriate in various business rules throughout the TRA content

Legacy privacy controls migrated into other ARS 5 controls:

References to legacy AR, DI, and DM controls have been updated across the TRA based on the NIST recommended mapping to new controls

In ARS 5, legacy CMS controls have been withdrawn and mapped into other standard controls:

References to the legacy CMS specific controls have been mapped to new controls based on guidance from the CMS ISPG policy team.

BR-ACID-6: Minimize Retention of PII in Identity Life-Cycle Management

BR-SAAS-4: Plan for Data Archival to Comply with Federal Records Management

Updated to reflect ARS changes:

Replaced withdrawn security control DM-2 with MP-6, SI-12, and SI-12(3)

Introduction (Foundation)

Disaster Recovery (Infrastructure Services)

TRA list of References (References)

ARS version change after update to ARS 5 :

Change to url security.cms.gov and https://security.cms.gov/policy-guidance/cms-acceptable-risk-safeguards-ars where applicable

CMS TRA Services Framework Architecture, Guidance, Services

CMS TRA Services Framework, Protecting Services, Framework Summary

Various topic places through the TRA that contain related information about the TRA Services Framework.

They can be found here, here, here, here, and here.

Added working breadcrumb links at the top of all pages.

Moved previous and next page icons to left bottom, out of the content and made them fixed. They no longer scroll with the content.

Some audience were unclear if the Services framework was mandatory:

Clarified language to state the CMS Services Framework is an option and that multi-tier is still valid (content since removed).

Inclusive and sensitive terminology ("man-made"):

Updated language to "human-caused"

Security update to API connector:

Applied new version of axios (v3.3) code.

Updated table and columns formatting

Navigation - provided additional links to changed material

Transform from pdf to online - duplicate figure and table numbers no longer applicable in web version:

Removed table and figure numbers

Transform from pdf to online:

Sequenced all url names to match order of content

Transform from pdf to online:

Updated hard references of "Volumes" for online

Transform from pdf to online:

Changed section number reference to link

Transform from pdf to online:

Updated hard references of "Volumes" for online

Transform from pdf to online:

Updated hard references of "Volumes" for online

Change wording to indicate that these networks operate at a high level of trust (vs explicitly trusted)

Edited the text to remove the explicit trust reference, indicating that CMSNet and CMS data centers operate at an elevated trust level, but best practice would be to authenticate all network connections (aligns to future zero trust security model being pushed through the recent Executive Order on Cybersecurity).

Remove IBM reference, but can retain reference to logical partitions. Cite the requirement for an AAA (Authorization, Auditing, Authentication) tool. RACF can be generically referred to as an example of such.

After review with TRB, the IBM references can remain. Added AA references and removed specific naming of RACF.

CMS Performance Management Systems;

BR-KSM-1: KSM Auditing Must Be Enabled and Connected to CMS Logging Infrastructure

Data and Database Management;

BR-DBM-3: Systems Must Meet CMS Data and Database Management Standards

Packaging and Delivery;

BR-PD-2: Software Target Packaging Must Be in Either the Operating System or Language Platform Native Form

Business Rules and Recommended Practices (Open Source);

BR-OSS-12: CMS-Released OSS Code Must Include Automated Unit Tests, Build Scripts and Be Checked for Software Vulnerabilities

Diagram depicts various specific tool names.

Added text to document to indicate a "sample" diagram.